Forum Discussion
Work Space Register - Query Shutdown-Start-VMs-By-Resource-Group Errors
I need query to show error´s in the
Shutdown-Start-VMs-By-Resource-Group
For create an alert in the Work Space, because de runbook is complete but generate error´s and the VM not power on.
you can check your runbook status with
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" | summarize count() by ResultType
You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started") | project TimeGenerated , RunbookName_s , ResultType , ResourceSo for use in an Azure Monitor Alert it would be something like this:
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed") // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group" | summarize count() by ResultTypeYou can force a value to be 0 or 1 by changing the last line to
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed") // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group" | summarize count() by ResultType | where count_ > 1 // put in your own threshold here | extend AggregatedValue = 1 // set this to One/1 if the threshold is breached
- CliveWatson
Microsoft
you can check your runbook status with
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" | summarize count() by ResultType
You then probably want to alter this to just look at "Failed" and maybe the specific runbook name?
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed" or ResultType == "Stopped" or ResultType == "Suspended" or ResultType == "Pending" or ResultType == "Started") | project TimeGenerated , RunbookName_s , ResultType , ResourceSo for use in an Azure Monitor Alert it would be something like this:
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed") // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group" | summarize count() by ResultTypeYou can force a value to be 0 or 1 by changing the last line to
AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "JobLogs" and (ResultType == "Failed") // and RunbookName_s == "Shutdown-Start-VMs-By-Resource-Group" | summarize count() by ResultType | where count_ > 1 // put in your own threshold here | extend AggregatedValue = 1 // set this to One/1 if the threshold is breachedCliveWatson thank´s for your answer . I verify and send the comments later.
@Clive Watson The query´s they work perfect , but in the Registre of Work Space only show me last day. I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.
CliveWatson The query´s they work perfect , but in the Registre of Work Space only show me last day. I modify the time range for last 7 seven days but not function. For solution i need show me more days in the query´s.
- CliveWatson
You need to add an extra line, assuming you have 30days of data, if you have more increase the value :-)
AzureDiagnostics | where TimeGenerated > ago(30d) // from time you run the query untilthe same time 30days ago //or AzureDiagnostics | where TimeGenerated > startofday(ago(30d)) // from midnight on that day - full day
